CVE-2026-34406
APTRS, a Python/Django reporting tool, had a flaw that let any user reach the edit_user endpoint and set the "is_superuser" flag to true. This gave the attacker full administrative control over the application. The issue was fixed in version 2.0.1.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
APTRS (Automated Penetration Testing Reporting System) versions prior to 2.0.1.
Real-world impact
An attacker who can reach the vulnerable endpoint can elevate their account to superuser, gaining unrestricted access to all data and functions, potentially compromising the entire system.
Why this severity
The CVSS score of 9.4 reflects the high impact of this privilege‑escalation flaw: it allows an attacker to gain full control (confidentiality, integrity, availability) with minimal effort and no user interaction.
What to do about it
- 01Upgrade APTRS to version 2.0.1 or later.
- 02Verify the upgrade was successful by checking the application version.
- 03Restart the APTRS service to apply the new code.
NVD-referenced vendor advisory
Timeline
- Mar 31, 2026 · Mar 31, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
- Jul 26, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- github.com/APTRS/APTRS/commit/d1f1b3a5…patch
- github.com/APTRS/APTRS/releases/tag/2.…release notes
- github.com/APTRS/APTRS/security/adviso…exploitvendor advisory